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Preface 


The  RAND  Corporation  was  asked  to  review  and  assess  the  Department  of  Defense  (DoD) 
responses  to  and  management  of  three  potential  anthrax-related  incidents  at  three  DoD  mail 
facilities  in  March  2005.  This  summary  provides  a  brief  description  of  RAND’s  approach, 
including  an  overview  of  the  analysis  based  on  relevant  plans  and  procedures  in  place  and 
how  the  actual  responses  compared  to  these  plans  and  procedures.  This  summary  should  be 
of  interest  not  only  to  DoD  senior  officials,  defense  agencies,  and  emergency  response  per¬ 
sonnel  but  also  to  those  policymakers  and  planners  involved  more  broadly  in  homeland 
defense  and  homeland  security. 

This  research  was  sponsored  by  the  Director  of  Administration  and  Management 
(D/A&M)  in  the  Office  of  the  Secretary  of  Defense  (OSD)  and  conducted  within  the 
International  Security  and  Defense  Policy  Center  of  the  RAND  National  Defense  Research 
Institute,  a  federally  funded  research  and  development  center  sponsored  by  the  Office  of  the 
Secretary  of  Defense,  the  Joint  Staff,  the  Unified  Combatant  Commands,  the  Department  of 
the  Navy,  the  Marine  Corps,  the  defense  agencies,  and  the  defense  Intelligence  Community. 

For  more  information  on  RAND’s  International  Security  and  Defense  Policy  Center, 
contact  the  Director,  Jim  Dobbins.  He  can  be  reached  by  e-mail  at  James_Dobbins@ 
rand.org;  by  phone  at  703-413-1100,  extension  5134;  or  by  mail  at  the  RAND  Corporation, 
1200  South  Hayes  Street,  Arlington,  Virginia  22202-5050.  More  information  about  RAND 
is  available  at  www.rand.org 
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AFB 

Air  Force  base 

ASD/HA 

Assistant  Secretary  of  Defense  (Health  Affairs) 

CDC 

Centers  for  Disease  Control  and  Prevention 
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Defense  Intelligence  Agency 
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Defense  Intelligence  Agency  Center 

DoD 

Department  of  Defense 
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Federal  Bureau  of  Investigation 
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Department  of  Health  and  Human  Services 
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Naval  District  of  Washington  Fire  and  Emergency  Services 
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National  Incident  Management  System 
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National  Response  Plan 
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Office  of  the  Secretary  of  Defense 
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Pentagon  Force  Protection  Agency 

RDF 

Remote  delivery  facility 
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Response  Management  Program 
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Strategic  National  Stockpile 
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USPS 

U.S.  Postal  Service 
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Executive  Summary 


This  report  provides  a  summary  of  each  of  the  three  potential  anthrax-related  incidents  that 
occurred  within  Department  of  Defense  (DoD)  mail  facilities  in  northern  Virginia  and 
Washington,  D.C.,  during  14-18  March  2005.  Each  of  these  incidents  presented  decision¬ 
makers  and  responders  with  different  challenges.  The  RAND  Corporation  was  asked  by 
DoD  to  examine  the  department’s  responses  to  and  management  of  the  incidents  and  to 
make  recommendations  for  future  improvement.  Drawing  on  national  standards  and  guide¬ 
lines,  RAND  analyzed  existing  plans  and  documented  actions  related  to  each  of  these  inci¬ 
dents  to  draw  conclusions  and  make  recommendations  at  both  the  facility-specific  level  and 
the  systemic,  overarching  level.  Based  on  the  research,  RAND  identified  a  number  of  areas  in 
which  plans  and  actions  were  aligned  and  responses  seemed  to  be  appropriate,  as  well  as  a 
number  of  areas  in  which  plans  and  actions  were  not  aligned  with  national  standards  and 
guidelines.  RAND  recommends  several  improvements  for  the  department’s  preparedness  and 
response  efforts:  align  preparedness  and  response  models  appropriately  to  the  disease  model 
(prepare  for  a  period  of  ambiguity  about  the  incident,  conduct  appropriate  environmental 
screening,  and  consider  the  upstream  and  downstream  issues);  consider  and  plan  according 
to  the  risk  to  and  value  of  different  facilities  (develop  and  apply  appropriate  methodology  for 
assessing  risk  and  value  and  plan  for  continuity  of  operations  for  critical  or  vulnerable 
locations);  conduct  systemwide  exercises  to  verify  that  plans  will  be  implemented 
appropriately;  and  use  the  National  Response  Plan  (NRP)  and  National  Incident  Manage¬ 
ment  System  (NIMS)  framework  for  incident  management,  command,  coordination,  and 
control  (this  requires  clarifying  roles,  particularly  of  senior  defense  officials,  to  avoid  confu¬ 
sion  and/or  dysfunction  and  will  facilitate  improved  coordination  and  communication  with 
relevant  jurisdictions). 


Background 

Since  October  2001,  concerns  about  anthrax  in  the  mail  have  prompted  many  federal  agen¬ 
cies  to  restructure  their  own  mail  operations  as  part  of  their  preparedness  and  response  to 
potential  terrorist  threats.  During  14-18  March  2005,  a  series  of  potential  anthrax- related 
incidents  occurred  at  three  DoD  mail  facilities  in  northern  Virginia  and  Washington,  D.C.: 
the  Pentagon  Remote  Delivery  Facility  (RDF),  the  TRICARE  Management  Activity  (TMA) 
suite  in  the  Skyline  Towers  complex,  and  the  Defense  Intelligence  Agency  (DIA)  RDF. 
DoD,  along  with  several  local  and  federal  response  agencies,  responded  to  the  incidents. 
While  further  tests  and  analyses  ultimately  determined  that  no  anthrax  was  present,  the  inci¬ 
dents  have  provided  an  invaluable  opportunity  for  learning.  These  three  incidents  presented 
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incident  managers  with  significantly  different  scenarios  and  elicited  three  very  different 
responses.  This  report  examines  each  of  these  incidents,  analyzes  the  adequacy  of  plans  and 
actions,  makes  recommendations  for  each,  and  concludes  with  an  analysis  of  the  larger  cross¬ 
cutting  issues  that  may  be  important  to  preparedness  for  and  response  to  future  biological 
incidents  departmentwide. 

Anthrax  is  a  disease  caused  by  a  spore-forming  Category  A  bacterial  agent  known  as 
Bacillus  anthracis  (B.  anthracis)  that  is  found  in  nature  and  that  may  cause  severe  disease 
in  animal  populations.  Anthrax  can  also  occur  in  humans,  in  three  forms: 

•  cutaneous  (when  spores  come  into  contact  with  the  skin  and  cause  skin  lesions) 

•  gastrointestinal  (when  spores  are  ingested  and  infect  the  digestive  tract) 

•  inhalational  (when  spores  are  aerosolized  and  inhaled  into  the  body’s  pulmonary  sys¬ 
tem). 

While  all  forms  of  anthrax  infection  are  serious,  inhalational  anthrax  is  almost  always 
fatal  if  untreated.  As  with  any  bioterrorism  agent,  the  model  for  understanding  the  potential 
risk  and  consequences  of  the  disease  (referred  to  in  this  report  as  the  threat  model)  for  B. 
anthracis  is  based  on  its  epidemiology  and  pathophysiology.  Important  considerations  for 
planning  appropriate  responses  to  anthrax  are  the  apparent  lack  of  person-to-person  trans¬ 
mission,  short  incubation  period,  clinical  severity,  and  importance  of  initiating  effective  ther¬ 
apy  promptly  after  environmental  exposure  or  onset  of  clinical  symptoms. 

In  October  2001,  as  a  result  of  letters  laced  with  anthrax  spores  sent  through  the 
U.S.  Postal  Service  (USPS)  system,  22  cases  of  anthrax  disease  were  documented  in  indi¬ 
viduals  along  the  U.S.  East  Coast.  The  2001  attacks  confirmed  fears  that  anthrax  could  be 
weaponized  effectively  and  disseminated  simply.  Since  2001,  there  has  been  a  concerted 
effort  to  improve  the  nation’s  response  to  any  future  anthrax  attacks. 

Compared  with  terrorist  attacks,  such  as  those  on  September  11,  2001,  biological 
events  (including  anthrax  exposure)  confront  decisionmakers  with  higher  degrees  of  ambi¬ 
guity  because  they  are  more  complex  in  several  important  ways.  First,  the  incident  evolves  over 
a  longer  period  of  time.  Detection  and  confirmation  of  a  biological  agent  take  time.  The  first 
signal  of  an  incident  may  be  when  exposed  people  become  ill  several  days  after  the  fact.  Even 
if  the  attack  is  discovered  through  environmental  screening,  some  time  will  have  elapsed 
between  the  possible  exposure  and  the  discovery  of  the  biological  agent.  Second,  victims  of 
biological  incidents  may  not  be  readily  identifiable.  Exposure  does  not  always  immediately 
result  in  illness.  However,  even  when  the  first  indication  of  a  biological  terrorism  event  is  the 
recognition  that  one  or  more  people  are  ill,  others  may  be  infected  but  not  yet  ill.  Finally, 
because  those  exposed  to  the  biohazard  might  not  be  identified  immediately  and  contained  appro¬ 
priately,  the  risk  may  spread  as  a  residt  of  cross-contamination  and  further  infection.  All  these 
characteristics  apply  to  anthrax  and  to  other  biological  threat  agents.  As  a  result,  timely 
response  actions  are  paramount  in  the  face  of  potential  anthrax  exposure. 

Improvements  in  Response  Capability 

Since  September  11  and  the  October  2001  anthrax  attacks,  the  United  States  has  taken 
action  in  two  critical  areas:  new  health  guidelines  and  incident  management  procedures.  For 
example,  the  Centers  for  Disease  Control  and  Prevention  (CDC)  has  outlined  several  health 
responses  to  prevent  the  development  of  anthrax  disease  among  individuals  exposed  to 
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spores.  These  recommended  responses  provide  the  guideline  against  which  RAND  evaluated 
DoD  plans  and  actions,  as  discussed  below.  In  addition,  the  federal  government  has  issued 
policies,  plans,  and  procedures  for  incident  management.  These  are  contained  in  the  NRP 
and  the  NIMS,  which  provide  guidance  on  how  federal,  state,  and  local  agencies  should 
respond  during  an  incident  or  potential  incident.  As  with  the  CDC  guidelines  above,  the 
NRP  and  NIMS  provide  a  basis  for  RAND’s  assessment  of  the  March  2005  incidents. 


Methodology 

Study  Objective 

RAND  was  asked  by  DoD  to  examine  the  department’s  response  to  and  management  of  the 
three  incidents  and  to  analyze  DoD  actions  against  existing  plans,  as  well  as  established  stan¬ 
dards  and  guidelines. 

Standards  and  Guidelines 

RAND’s  assessment  is  based  on  established  standards  and  guidelines  in  the  areas  of  incident 
management  and  health  and  safety,  promulgated  by  the  Department  of  Homeland  Security 
at  the  direction  of  the  White  House  and  the  CDC,  respectively.  These  are  summarized 
below. 

Incident  Management:  The  NRP  and  NIMS 

To  provide  a  standardized  system  and  nomenclature  for  incident  response  and  management, 
President  Bush  directed  (see  Homeland  Security  Presidential  Directive-5  (HSPD-5),  the 
creation  of 

a  National  Incident  Management  System  .  .  .  [to]  provide  a  consistent  nationwide 
approach  for  Federal,  State,  and  local  governments  to  work  effectively  and  efficiently 
together  to  prepare  for,  respond  to,  and  recover  from  domestic  incidents.  To  pro¬ 
vide  for  interoperability  and  compatibility  among  Federal,  State,  and  local  capa¬ 
bilities  the  NIMS  will  include  a  core  set  of  concepts,  principles,  terminology,  and 
technologies  covering  incident  command  system;  multi-agency  coordination  sys¬ 
tems;  unified  command;  training;  identification  and  management  of  resources. 

A  committee  of  government  officials  created  the  NIMS  by  examining  the  various 
incident  command  and  management  systems  that  existed  at  the  time.  After  extensive  consul¬ 
tations  with  all  major  stakeholders,  they  created  a  single  framework  that  captured  the  best 
practices.  The  NIMS  gives  practical  guidance  and  procedures  to  those  involved  with  incident 
management,  whether  the  incidents  are  naturally  occurring  or  deliberately  caused.  The 
NIMS  applies  to  all  levels  of  government,  and  for  the  federal  government,  it  is  prescriptive. 

Also  in  HSPD-5,  the  President  called  for  “a  National  Response  Plan  (NRP)  .  .  .  [to] 
integrate  Federal  Government  domestic  prevention,  preparedness,  response,  and  recovery 
plans  into  one  all-discipline,  all-hazards  plan.”  This  plan  replaces  the  multiple  emergency 
response  plans  that  had  previously  existed  in  federal  government  departments  and  agencies 
with  one  comprehensive  plan.  The  NRP  is  based  on  the  operational  concepts  articulated  in 
the  NIMS,  and  they  are  a  companion  set  of  documents.  Hence,  this  report  will  refer  to  these 
guidance  documents  as  the  NRP/NIMS. 
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The  Secretary  of  Defense,  along  with  the  heads  of  31  other  federal  departments  and 
agencies,  signed  the  Letter  of  Agreement  contained  in  the  NRP,  committing  the  Defense 
Department,  among  other  things,  to 

•  “Supporting  NRP  concepts,  processes,  and  structures  and  carrying  out  their  assigned 
functional  responsibilities  to  ensure  effective  and  efficient  incident  management, 
including  designating  representatives  to  staff  interagency  coordinating  structures,  as 
required; 

•  “Modifying  existing  interagency  and  agency  incident  management  and  emergency 
response  plans  to  facilitate  compliance  with  the  NRP; 

•  “Forming  and  maintaining  incident  management  partnerships  with  State,  local, 
tribal,  and  regional  entities,  the  private  sector,  and  nongovernmental  organizations; 
and 

•  “Developing,  exercising  and  refining  headquarters  and  regional  capabilities  to  ensure 
sustained  operational  readiness  in  support  of  the  NRP.” 

Health  and  Safety  Guidelines 

The  Department  of  Health  and  Human  Services  (HHS)  is  the  federal  government’s  lead 
agency  for  health  responses  to  bioterror  events.  Under  the  framework  of  the  NRP/NIMS, 
HHS  provides  guidance  for  federal  planning  and  responses  to  bioterror  events.  For  purposes 
of  this  report,  two  components  of  this  guidance  are  important:  guidance  for  specific  health 
responses  and  for  coordinating  the  federal  response  (e.g.,  notifying  applicable  federal  gov¬ 
ernment  organizations,  mobilizing  prophylactic  drugs  from  the  Strategic  National  Stockpile 
[SNS]).  The  CDC,  a  subordinate  agency  of  HHS,  is  the  well-accepted  authoritative  source 
of  guidance  on  health  responses,  and  the  Office  of  the  Assistant  Secretary  for  Public  Health 
Emergency  Preparedness  is  the  source  for  coordinating  the  federal  responses.  This  report 
compares  DoD  plans  and  actions  to  relevant  HHS  health  and  safety  guidelines. 

Analysis  of  Plans  and  Actions 

The  RAND  research  team  used  the  NIMS/NRP  and  HHS/CDC  guidelines  to  judge  the 
adequacy  of  DoD  plans  and  actions.  Plans  and  information  about  actions  were  collected, 
with  the  assistance  of  Washington  Headquarters  Services,  from  documents  and  interviews. 
Data  collection  ended  in  mid-May  2005. 

Using  a  three-pronged  approach,  the  RAND  team  first  conducted  a  thorough  docu¬ 
ment  review  and  analysis.  This  included  reviewing  all  applicable  policies,  procedures,  and 
directives;  concepts  of  operations;  implementation  plans;  agreements  and  protocols;  and 
other  related  documents.  The  team  also  reviewed  and  analyzed  all  available  records  of  com¬ 
munications  and  actions  taken  by  federal,  state,  local,  and  private  entities  in  response  to  the 
incidents  collected  by  federal,  state,  local,  and  private  entities.  Second,  the  RAND  team 
interviewed  more  than  100  individuals  from  more  than  20  organizations.  Third  and  finally, 
RAND  also  visited  DoD-owned,  -contracted,  and  -leased  facilities  to  inspect  the  layout, 
processes,  standards,  and  protocols  related  to  the  incidents. 

For  each  incident,  researchers  considered  plans  and  actions  related  to  environmental 
screening,  health  and  safety  response,  and  incident  management.  Where  applicable,  internal 
DoD-wide  issues,  as  well  as  issues  external  to  DoD,  were  considered.  This  process  led 
RAND  to  draw  specific  conclusions  about  the  adequacy  of  plans  and  actions  for  each  inci- 
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dent,  to  assess  corrective  actions  implemented  prior  to  the  publication  of  this  report,  and  to 
make  recommendations  to  DoD  for  further  revising  its  plans  and  procedures.  The  following 
section  summarizes  RAND’s  findings  for  each  incident. 


The  Three  Incidents — Findings 

Each  of  the  three  incidents  presented  a  different  situation  and  response.  The  fact  that  these 
three  events  occurred  during  one  week  in  March  was  fortuitous  in  that  it  prompted  DoD  to 
once  again  consider,  and  continue  to  improve,  its  systemic  ability  to  respond  to  potential 
bioterrorism  events. 

The  Pentagon 

The  Pentagon  serves  as  the  headquarters  of  DoD  and  as  the  primary  office  facility  for  the 
Office  of  the  Secretary  of  Defense  (OSD),  as  well  as  the  four  military  services.  It  is  located  in 
Arlington  County,  Virginia,  near  Washington,  D.C. 

On  10  March  2005,  a  sample  from  the  mail-handling  room  was  sent  for  testing  to  an 
external  lab.  The  external  lab  reported  a  tentative  indication  of  anthrax  to  the  contractor 
running  the  mailroom;  the  latter  apparently  did  not  understand  this  telephone  communica¬ 
tion  as  a  potentially  positive  test.  The  following  Monday,  14  March,  the  mail  from  10 
March  was  erroneously  released  to  the  Defense  Post  Office  (DPO)  early  in  the  morning.  The 
lab  then  informed  the  mailroom  contractor  that  the  10  March  sample  had  tested  positive  for 
anthrax.  The  contractor  informed  DPO,  and  DPO  informed  the  Pentagon  Force  Protection 
Agency  (PFPA). 

This  notification  set  in  motion  a  large-scale  response.  PFPA  took  control  of  the  facil¬ 
ity,  and  the  Assistant  Secretary  of  Defense  for  Health  Affairs  (ASD/HA)  and  the  Com¬ 
mander  of  the  DiLorenzo  TRICARE  Health  Clinic  (DTHC)  ran  the  Pentagon  health 
response.  The  PFPA  response  and  health  response  were  coordinated,  but  separate,  efforts. 

Arlington  County  was  contacted  early  in  the  incident  but  did  not  play  a  major  role 
because  PFPA  and  other  Pentagon  elements  handled  the  incident.  Of  note,  county  health 
officials  felt  that  they  were  inadequately  consulted  on  the  administration  of  prophylaxis  and 
other  health  responses. 

Subsequent  testing  and  investigation  determined  the  incident  to  be  a  false  alarm,  and 
normal  operations  resumed  at  the  Pentagon  on  Friday,  18  March. 

TMA  Skyline 

The  TMA  is  the  organization  responsible  for  managing  and  directing  the  TRICARE  pro¬ 
gram,  DoD’s  health  benefit  program  for  military  beneficiaries.  TMA  reports  to  the 
ASD/HA.  TMA’s  Washington-based  operations  are  located  in  office  suites  throughout  the 
Skyline  complex  in  Falls  Church,  Virginia.  The  Skyline  facility  is  an  office  tower  complex 
owned  and  leased  by  a  private  company.  DoD,  along  with  several  other  federal  agencies  and 
private  businesses,  leases  and  occupies  office  space  throughout  the  complex. 

On  the  morning  of  14  March,  mail  for  TMA  was  picked  up,  promptly  sorted,  and 
placed  in  various  TMA  mailboxes  for  pickup.  Later  that  morning,  the  mailroom  staff  was 
informed  that  there  was  a  problem  with  the  mail.  TMA  staff  began  pulling  mail  out  of  mail- 
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boxes  and  retrieving  mail  that  had  already  been  picked  up.  An  alarm  went  off  in  the  mail- 
room,  which  the  staff  interpreted  (incorrectly)  as  indicating  the  presence  of  anthrax. 

TMA  staff  immediately  called  both  defense  security  staff  and  911.  The  Fairfax 
County  H azardous  Materials  (HAZMAT)  team  was  alerted  and  sent  to  Skyline.  They  made 
a  reconnaissance  of  the  TMA  mailroom,  visually  inspected  the  room  and  found  no  suspi¬ 
cious  physical  evidence  (e.g.,  no  suspicious  material  or  potential  anthrax  dispersal  device). 
The  county’s  Emergency  Manager  notified  the  Fairfax  Fiealth  Director  shortly  thereafter  and 
began  taking  appropriate  protective  measures. 

Fairfax  County  first  responders  established  a  unified  command  under  the  NIMS 
Incident  Control  System.  The  county  FLAZMAT  team  tested  numerous  environmental  sam¬ 
ples.  These  tests  could  not  rule  out  a  biological  organism  in  the  mailroom.  Fairfax  County 
responders  reported  that  their  actions  were  based  on  the  county’s  “Biohazard  Detection  Sys¬ 
tem  Plan.” 

Employees  were  sheltered-in-place,  asked  to  remain  in  the  office  suites  on  their  floor, 
some  workers  apparently  left  the  building  during  this  period.  It  was  several  hours  before 
Fairfax  County  officials  informed  occupants  about  what  was  happening  and  what  they 
needed  to  do.  Interviewees  reported  general  frustration  about  the  lack  of  information. 

Later  that  evening,  the  Fairfax  Fire  Department  initiated  a  controlled  evacuation, 
floor  by  floor  in  each  tower,  to  release  occupants  to  go  home.  At  that  point,  Fairfax  County 
Fiealth  and  Fiuman  Services  assumed  incident  command,  as  county  officials  determined  that 
the  predominant  concerns  were  then  about  public  health  (e.g.,  whether  medical  treatment 
was  needed  and  when  the  building  could  be  reopened  safely). 

The  DoD  workers  most  directly  affected  subsequently  reported  to  the  DTFiC  and 
received  antibiotics  and  appropriate  instruction.  Later  on  14  March,  the  Fairfax  County 
Fiealth  Department  assumed  responsibility  for  providing  postexposure  prophylaxis  (PEP)  to 
the  remaining  building  occupants,  if  needed,  the  following  day.  The  Virginia  SNS  coordina¬ 
tor  arranged  for  prophylactic  antibiotics  (ciprofloxacin)  from  the  SNS,  and  the  county  health 
department  organized  dispensing  teams  for  the  following  day,  15  March.  When  anthrax  was 
ruled  out  at  both  the  Pentagon  RDF  and  Skyline  on  15  March,  the  individuals  from 
TMA/ Skyline  offered  PEP  at  DTFiC  were  told  that  it  was  safe  to  discontinue  treatment;  the 
Arlington  County  PEP-dispensing  teams  were  disbanded  and  supplies  returned  to  the  SNS. 

Defense  Intelligence  Agency 

The  DIA  has  a  worldwide  mission  of  intelligence  production  for  the  DoD.  Its  headquarters 
are  located  on  Bolling  Air  Force  Base  (AFB)  in  southeast  Washington,  D.C.  The  DIA  RDF 
is  separate  from  the  main  Defense  Intelligence  Analysis  Center  (DIAC).  Mail  processing 
takes  place  in  a  mailroom  equipped  with  protective  measures  and  showers  that  can  be  used 
for  decontamination.  Mailroom  personnel  run  tests  for  biological  hazards  on  site.  Should  it 
be  needed,  laboratory  verification  and  confirmation  would  occur  through  the  Armed  Forces 
Institute  of  Pathology  or  the  Federal  Bureau  of  Investigation  (FBI)  (timetable  unknown).  In 
addition  to  mail-processing  equipment  and  personnel,  the  RDF  houses  the  DIA’s  Response 
Management  Program  (RMP)  Office. 

On  18  March  2005,  the  mailroom  staff  began  batch-processing  mail  in  accordance 
with  established  procedures.  The  hazardous  substance  detection  system  indicated  the  possible 
presence  of  anthrax  during  the  processing  cycle.  The  mailroom  staff  largely  followed  estab¬ 
lished  procedures  for  responding  to  the  alarm.  They  sheltered  in  place  and  notified  DIA 
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security  officials.  This  initiated  a  full  emergency  response  by  DIA  authorities  and  emergency 
responders.  The  mail  handlers  also  informed  RMP  Office  tenants  in  the  RDF. 

DIA  security  personnel  were  the  first  to  respond,  and  they  quickly  secured  the  area 
and  contacted  the  Naval  District  of  Washington  Fire  and  Emergency  Services  (NDW/ES). 
Shortly  thereafter,  the  first-arriving  NDW/ES  fire-fighting  units  surveyed  the  scene  and 
requested  the  NDW/ES  HAZMAT  team.  The  NDW/ES  HAZMAT  Captain  took  over 
Incident  Command,  as  did  the  NDW/ES  Fire  Chief  when  he  arrived  roughly  45  minutes 
into  the  event.  In  addition,  the  Bolling  AFB  medical  clinic  staff  and  the  11th  Wing 
Bio/Environmental  unit  were  on  the  scene  to  assist  with  agent  detection  and  related 
activities.  When  he  discovered  that  two  RMP  employees  had  entered  the  DIAC,  the  Incident 
Commander  (the  NDW/ES  Fire  Chief)  ordered  it  locked  down  and  all  staff  inside  to  shelter 
in  place  until  the  potentially  contaminated  personnel  could  be  located.  The  NDW/ES 
response  team  established  a  decontamination  site,  but  it  was  later  deemed  unnecessary. 

Extensive  environmental  testing  did  not  identify  anthrax.  Follow-on  tests  conducted 
by  mailroom  personnel  were  also  negative.  The  NDW/ES  event  chronology  indicates  that 
the  RDF  event  was  declared  “closed”  approximately  three  hours  after  the  initial  alarm.  Per¬ 
sonnel  within  the  RDF  during  the  event  were  offered  medical  assistance. 

This  response  was  local,  requiring  only  the  NDW/ES  and  assets  on  Bolling  AFB. 
PFPA  was  alerted  and  dispatched  a  team  as  well,  but  it  was  not  needed.  In  addition,  the  11th 
Wing  Operations  Center  notified  Joint  Force  Headquarters,  National  Capital  Region,  its 
interface  to  the  NIMS,  and  FBI  personnel  arrived  after  the  event  was  over  to  collect  samples 
for  lab  testing. 


Overall  Assessment:  Implications  for  DoD  Preparing  for  and  Responding  to 
Biological  Incidents 

While  the  above  sections  focused  on  the  incidents  at  each  separate  facility,  this  section 
attempts  to  draw  out  significant  overarching  issues  that  cut  across  all  these  incidents.  The 
intent  is  to  identify  the  lessons  learned  and  to  be  learned  from  these  incidents  within  two 
major  categories — preparedness  and  response — as  well  as  to  identify  the  crucial  elements  of 
each  that  emerged  from  RAND’s  analysis  of  these  incidents. 

Preparedness 

For  preparations  to  be  effective,  planners  must  have  some  idea  of  what  they  are  preparing 
for — that  is,  what  an  attack  might  look  like,  who  and  what  will  be  affected  by  an  attack,  and 
what  responses  will  be  effective.  RAND’s  research  identified  three  major  issues  that  have 
implications  for  DoD  preparations  for  future  biological  incidents.  These  are  discussed  briefly 
below. 

Preparations  Appropriate  for  the  Anthrax  Disease  Model.  Preparation  for  terrorist 
attacks  requires  planning  for  expected  scenarios,  training  personnel  who  will  play  roles  in 
responses  to  an  attack,  and  exercising  those  plans  and  personnel.  These  plans  should  also 
recognize  the  potential  upstream  and  downstream  effects  of  the  incident  within  the  mail¬ 
handling  system  and  include  appropriate  strategies  for  coordination  and  notification. 

Consideration  of  the  Risk  to  and  Value  of  Facilities.  One  size  does  not  fit  all.  As  such, 
preparedness  efforts  should  take  into  consideration  the  varying  levels  of  risk  and  other  factors 
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associated  with  facilities  (e.g.,  as  potential  targets  of  terrorism  or  type  of  consequences  from 
the  disruption  of  operations,  etc.)  and  allow  flexibility  in  devising  preparedness  plans  and 
strategies.  A  methodology  that  assesses  risk,  value,  and  potential  consequences  (among  other 
factors)  could  facilitate  the  determination  of  appropriate  protections  for  mailrooms  and  other 
routine  operations  and  lead  to  departmentwide  guidance  for  consistent  approaches  to  secu¬ 
rity  at  its  many  different  facilities. 

Exercise  and  Verification.  Once  preparedness  plans  are  appropriately  designed,  care  is 
also  required  to  ensure  that  individuals  and  organizations  have  the  requisite  levels  of  compe¬ 
tence  and  readiness,  as  evidenced  by  their  technical  expertise,  training,  and  supervision  needs. 
Without  such  exercises,  gaps  in  plans  will  not  be  identified.  In  March  2005,  two  problems 
exemplified  the  importance  of  such  exercises:  the  process  of  outsourcing  critical  functions  to 
vendors  or  contractors  who  lack  the  appropriate  technical  expertise  and  the  lack  of  specific 
roles  for  senior  DoD  officials  in  incident  management.  For  example,  the  lack  of  specified 
roles  contributed  to  several  ad  hoc  responses  in  DoD’s  management  of  the  RDF  incident. 

Response 

Once  plans  are  appropriately  devised  (according  to  what  is  being  defended  against,  appropri¬ 
ate  standards  and  guidelines,  and  tailored  to  a  specific  facility)  and  exercised  and  personnel 
are  trained,  appropriate  and  timely  responses  should  follow  accordingly.  Based  on  the  three 
incidents  in  March  2005,  RAND’s  analyses  identified  several  issues  related  to  response  that 
should  be  improved  and  have  implications  for  DoD’s  response  to  future  biological  incidents. 
These  are  presented  here  in  a  generic  format  and,  when  applied  to  a  specific  plan,  could 
become  classified.  These  include 

•  implementation  of  the  NRP/NIMS  and  the  implications  for 

-  unified  command 

-  lines  of  command  and  control 

-  higher-level  coordinating  structures  of  the  NRP 

•  coordination  of  health  responses 

•  public  communications 

•  care  for  the  workforce  and  concern  for  the  public. 


Conclusion 

During  14-18  March  2005,  DoD  responded  to  and  managed  three  potential  anthrax-related 
incidents  in  three  separate  facilities.  The  response  and  management  of  each  incident  was 
separate,  and  each  revealed  different  problems  in  the  department’s  preparedness  and  response 
plans.  The  most  critical  problem  identified  was  the  noncompliance  with  the  NRP/NIMS 
framework.  This  disconnect  led  to  several  related  problems,  including  the  ad  hoc  responses 
implemented  by  senior  DoD  officials  and  poor  communication  and  coordination  with  other 
agencies. 

As  with  battle  management,  incident  management  presents  a  chaotic  situation  full  of 
uncertainty — “the  fog  of  war” — to  responders  and  decisionmakers  alike.  While  maintaining 
a  healthy  respect  for  the  fog  of  war,  the  U.S.  military  has  rejected  the  notion  that  such  cha¬ 
otic  situations  must  be  left  to  individual  capabilities  and  ad  hoc  decisions  alone.  Because  so 
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much  is  at  stake,  ways  of  managing  uncertainty  and  the  unexpected  nature  of  such  events 
must  be  envisioned  and  developed  for  these  incidents.  It  is  now  commonly  acknowledged  by 
the  military  that  efforts  to  “manage  chaos”  can  and  do  result  in  incredible  improvements  in 
outcomes. 

The  incident  response  community,  particularly  in  facing  the  threat  after  the  2001 
attacks,  has  developed  the  first  generation  of  a  similar  concept  and  system  for  managing 
domestic  incidents:  the  NRP  and  the  NIMS.  This  system  is  designed  to  provide  the  tools  of 
incident  management  and  response  for  the  military,  public  health,  law  enforcement  and  fire 
responders,  and  duly  constituted  civilian  authorities  across  the  federal  system  of  government. 
It  incorporates  the  best  incident  management  practices  developed  in  the  incident  manage¬ 
ment  community  over  the  past  several  decades.  It  addresses  such  complex  questions  as  who  is 
to  exercise  what  authorities  in  what  circumstances  and  when  such  authorities  must  be  coor¬ 
dinated  with  other  organizations  and  jurisdictions.  It  is  premised  on  the  assumption  that  all 
parties  will  adopt  the  NRP/NIMS  as  their  standard  for  response.  Within  this  framework, 
federal  agencies,  state  officials,  and  local  authorities  and  responders  can  effectively  apply  their 
skills  and  authorities. 

Much  of  RAND’s  critique  above  reflects  the  fact  that  DoD  has  not  fully  adopted  this 
system.  While  the  department  has  invested  a  significant  amount  of  effort  into  planning  for 
terrorism,  specified  roles  and  responsibilities  called  for  by  the  NRP  and  the  NIMS  were  not 
defined  at  the  time  of  these  incidents,  and  senior  decisionmakers  were  not  trained  in  their 
duties  under  this  system.  This  forced  DoD  managers  and  senior  leaders  to  respond  with  ad 
hoc  decisions  and  actions.  While  it  could  be  argued  that  DoD  officials  made  good  decisions 
under  the  circumstances  they  faced  in  mid-March  2005,  there  is  little  doubt  that,  if  a  well- 
rehearsed,  NRP-  and  NIMS-compliant  plan  had  been  put  into  action,  it  would  have  pro¬ 
duced  much  better  results.  If  this  had  been  a  real  attack,  such  plans  and  actions  would  have 
ensured  the  proper  preparation  for  transition  to  a  full  incident  of  national  significance. 


